4 ms·
"There are people thinking an interface or feature is secure when it is merely a window dressing that can be bypassed with just a bit more knowledge about the s
by absolute100 6y ago
"There are people thinking an interface or feature is secure when it is merely a window dressing that can be bypassed with just a bit more knowledge about the stack. " -- Jessie Frazelle shares one of the toughest problems when dealing with complexity. It's hard to understand where it starts and where it ends, and we create holes all around us due to the inherent limitations - It's too hard for humans to reason about so many moving pieces. What should we do about it? I don't know. Maybe make it more visible so that others can make better (not perfect) decisions. Perhaps acknowledge our limitations and practice more concepts from Resilient/Choas Engineering to see where our intuition breaks.
- jorangreef 6y agoChaos engineering is brilliant for improving the resilience, safety and availability of a system, but I'm not sure it would help improve the security of a system to the degree that the author describes, i.e. to prevent the SoftLayer firmware hack. We need more knowledge, more education, more auditing, more communication, and this across all levels of the stack. If we use abstraction, perhaps we need to recognize that abstraction does not absolve us of the responsibility for auditing the implementation, and that abstraction has not only value but also cost. To make this easier across so many dimensions, we probably want to simplify our stacks and minimize our dependencies and supply chains far more drastically than we do. There's also a cost to all this understanding, and it comes down to what the business values. Security or velocity. But perhaps you can get both, especially as you design for simpler systems.